Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OCPBUGS-17035: fix KRP permissions for Thanos Querier #2057

Merged
merged 1 commit into from Nov 17, 2023
Merged

OCPBUGS-17035: fix KRP permissions for Thanos Querier #2057

merged 1 commit into from Nov 17, 2023

Conversation

rexagod
Copy link
Member

@rexagod rexagod commented Aug 1, 2023 •
edited

fix KRP configuration for thanos-querier in order to enforce restricted
access only to entities allowed to [http-verb] for pods.metrics.k8s.io

Signed-off-by: Pranshu Srivastava rexagod@gmail.com

  • I added CHANGELOG entry for this change.
  • No user facing changes, so no entry in CHANGELOG was needed.

@openshift-ci-robot openshift-ci-robot added jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 1, 2023
@openshift-ci-robot
Copy link
Contributor

@rexagod: This pull request references Jira Issue OCPBUGS-17035, which is invalid:

  • expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

fix rbac rules for thanos-querier for pods by specifying the correct apiVersion

  • I added CHANGELOG entry for this change.
  • No user facing changes, so no entry in CHANGELOG was needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@rexagod
Copy link
Member Author

rexagod commented Aug 1, 2023

/jira refresh

@openshift-ci-robot
Copy link
Contributor

@rexagod: An error was encountered querying GitHub for users with public email (juzhao@redhat.com) for bug OCPBUGS-17035 on the Jira server at https://issues.redhat.com/. No known errors were detected, please see the full error message for details.

Full error message. Post "http://ghproxy/graphql": dial tcp 172.30.229.2:80: connect: connection refused

Please contact an administrator to resolve this issue, then request a bug refresh with /jira refresh.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

simonpasquier
simonpasquier reviewed Aug 8, 2023
View reviewed changes
Copy link
Contributor

@simonpasquier simonpasquier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to update the assertTenancyForMetrics e2e test.
Right now it creates a test service account to verify that a user can query metrics from their namespace but it grants the "admin" role which is too permissive. I'd advise to create a role with just-enough permissions allowing to get pod metrics.

jsonnet/components/thanos-querier.libsonnet Outdated Show resolved Hide resolved
jsonnet/components/thanos-querier.libsonnet Outdated Show resolved Hide resolved
@rexagod rexagod force-pushed the OCPBUGS-17035 branch 5 times, most recently from 2520236 to c2fcef4 Compare August 8, 2023 21:25
@rexagod
Copy link
Member Author

rexagod commented Aug 8, 2023

/retest

@rexagod rexagod force-pushed the OCPBUGS-17035 branch 2 times, most recently from 46fc05a to ddab55a Compare August 9, 2023 10:11
@rexagod
Copy link
Member Author

rexagod commented Aug 9, 2023

/test e2e-aws-ovn-single-node

simonpasquier
simonpasquier reviewed Aug 9, 2023
View reviewed changes
test/e2e/framework/framework.go Outdated Show resolved Hide resolved
test/e2e/user_workload_monitoring_test.go Outdated Show resolved Hide resolved
@rexagod rexagod force-pushed the OCPBUGS-17035 branch 10 times, most recently from 5f6d166 to 8676114 Compare August 12, 2023 17:33
@jan--f
Copy link
Contributor

jan--f commented Nov 10, 2023

/jira refresh

@openshift-ci-robot
Copy link
Contributor

@jan--f: This pull request references Jira Issue OCPBUGS-17035, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.15.0) matches configured target version for branch (4.15.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @juzhao

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@rexagod rexagod force-pushed the OCPBUGS-17035 branch 4 times, most recently from 9116c65 to efbba1d Compare November 11, 2023 18:44
@rexagod rexagod changed the title OCPBUGS-17035: refactor thanos-querier tests OCPBUGS-17035: fix KRP permissions for Thanos Querier Nov 11, 2023
@openshift-ci-robot
Copy link
Contributor

@rexagod: This pull request references Jira Issue OCPBUGS-17035, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.15.0) matches configured target version for branch (4.15.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @juzhao

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

fix KRP configuration for thanos-querier in order to enforce restricted
access only to entities allowed to [http-verb] for pods.metrics.k8s.io

Signed-off-by: Pranshu Srivastava rexagod@gmail.com

  • I added CHANGELOG entry for this change.
  • No user facing changes, so no entry in CHANGELOG was needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@rexagod
Copy link
Member Author

rexagod commented Nov 11, 2023

Tested for GET and POST requests with a ServiceAccount linked to a ClusterRole having get and create verb permissions on pods.metrics.k8s.io. PTAL below for details.

Details

[From the ticket] [...] and thus I want to only add the minimal necessary permissions [...]

I used the same ClusterRole as we use for Thanos Querier's KRP container, hence the additional *reviews permissions, but only pods.metrics.k8s.io is needed to query the endpoint in question as shown below.

-X GET

Screenshot 2023-11-12 at 00 21 47

-X POST

Screenshot 2023-11-12 at 00 24 23

@rexagod
OCPBUGS-17035: fix KRP permissions for Thanos Querier
9e9b738 
fix KRP configuration for thanos-querier in order to enforce restricted
access only to entities allowed to [http-verb] for pods.metrics.k8s.io

Signed-off-by: Pranshu Srivastava <rexagod@gmail.com>
@jan--f
Copy link
Contributor

jan--f commented Nov 13, 2023

Thanks! To me this looks good.
/lgtm
Just putting a
/hold
for @simonpasquier to get a chance to look at this.

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 13, 2023
@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 13, 2023
@rexagod
Copy link
Member Author

rexagod commented Nov 13, 2023

/retest

@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Nov 13, 2023

@rexagod: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/versions 9e9b738 link false /test versions

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

simonpasquier
simonpasquier reviewed Nov 17, 2023
View reviewed changes
Copy link
Contributor

@simonpasquier simonpasquier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@simonpasquier
Copy link
Contributor

/label acknowledge-critical-fixes-only

@openshift-ci openshift-ci bot added the acknowledge-critical-fixes-only Indicates if the issuer of the label is OK with the policy. label Nov 17, 2023
@simonpasquier
Copy link
Contributor

/hold cancel

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 17, 2023
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Nov 17, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jan--f, rexagod, simonpasquier

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [jan--f,rexagod,simonpasquier]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot openshift-merge-bot bot merged commit b0ee4d6 into openshift:master Nov 17, 2023
16 of 17 checks passed
@openshift-ci-robot
Copy link
Contributor

@rexagod: Jira Issue OCPBUGS-17035: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-17035 has been moved to the MODIFIED state.

In response to this:

fix KRP configuration for thanos-querier in order to enforce restricted
access only to entities allowed to [http-verb] for pods.metrics.k8s.io

Signed-off-by: Pranshu Srivastava rexagod@gmail.com

  • I added CHANGELOG entry for this change.
  • No user facing changes, so no entry in CHANGELOG was needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-bot
Copy link
Contributor

[ART PR BUILD NOTIFIER]

This PR has been included in build cluster-monitoring-operator-container-v4.15.0-202311171551.p0.gb0ee4d6.assembly.stream for distgit cluster-monitoring-operator.
All builds following this will include this PR.

@openshift-merge-robot
Copy link
Contributor

Fix included in accepted release 4.15.0-0.nightly-2023-11-17-183843

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jan--f jan--f jan--f left review comments

@simonpasquier simonpasquier simonpasquier left review comments

@marioferh marioferh Awaiting requested review from marioferh

@sthaha sthaha Awaiting requested review from sthaha

@slashpai slashpai Awaiting requested review from slashpai

@JoaoBraveCoding JoaoBraveCoding Awaiting requested review from JoaoBraveCoding

@juzhao juzhao Awaiting requested review from juzhao

Assignees

@jan--f jan--f

@simonpasquier simonpasquier

Labels
acknowledge-critical-fixes-only Indicates if the issuer of the label is OK with the policy. approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@rexagod @openshift-ci-robot @simonpasquier @jan--f @openshift-bot @openshift-merge-robot